IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

L (Currently Amended) A method of providing security, comprising: 

accessing a databas e file configured bv a process to store operational 
information associated with [[a]] the process; 

determining a first behavior using the operational information, wherein the 
first behavior is associated with the process; 

monitoring the process; comparing a second behavior with the first 
behavior, wherein the second behavior is attempted by the process; and 

performing a predetermined responsive action if the second behavior is 
different from the first behavior; 

wherein the operational information includes a list of one or more 
resources accessed by the process in the course of a normal and permitted operation; and 
the databas e file is used by the process in the course of said normal and permitted 
operation to enable the process to access said resources in an optimiz e d mann e r ; and 
determining the first behavior includes parsing the file to identify the one or more 
resources . 

2. (Previously Presented) The method of providing security as recited in Claim 1, in an 
event the second behavior is determined to be different from the first behavior, the second 
behavior is determined to be disallowed. 

3. (Previously Presented) The method of providing security as recited in Claim 1, wherein 
the first behavior is one of a plurality of behaviors determined using the operational information. 

4. (Previously Presented) The method of providing security as recited in Claim 1, wherein 
the first behavior is one of a plurality of behaviors determined using the operational information, 
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and in the event the second behavior is determined to be different from the plurality of behaviors, 
the second behavior is determined to be disallowed. 

5. (Previously Presented) The method of providing security as recited in Claim 1, further 
comprising determining that the second behavior is disallowed. 

6. (Previously Presented) The method of providing security as recited in Claim 1, further 
comprising determining that the second behavior is disallowed and performing a predetermined 
action. 

7. (Previously Presented) The method of providing security as recited in Claim 1, wherein 
the predetermined action includes preventing the second behavior from succeeding. 

8. (Previously Presented) The method of providing security as recited in Claim 1, wherein 
the predetermined action includes generating an event associated with the second behavior. 

9. (Previously Presented) The method of providing security as recited in Claim 1, wherein 
determining the first behavior using the operational information is performed when the process is 
not operating. 

10. (Canceled) 

11. (Previously Presented) The method of providing security as recited in Claim 1, wherein 
the operational information includes information is used to improve process initialization time. 

12. (Previously Presented) The method of providing security as recited in Claim 1, wherein 
the operational information is configured on a per user basis. 

13. (Previously Presented) The method of providing security as recited in Claim 1, wherein 
the operational information includes component access information. 

14. (Currently Amended) The method of providing security as recited in Claim 1, wherein 
the database file includes a prefetch file. 
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15. (Currently Amended) The method of providing security as recited in Claim 1, wherein 
the database file includes a superfetch file. 

16. (Currently Amended) A system for providing security, comprising: 

a processor configured to: 

access a databas e file configured by a process to store operational 
information associated with [[a]] the process; 

determine a first behavior using the operational information, 
wherein the first behavior is associated with the process; 

monitor the process; 

compare a second behavior with the first behavior, wherein the 
second behavior is attempted by the process; and 

perform a predetermined responsive action if the second behavior 
is different from the first behavior; and 

a memory coupled with the processor, configured to provide the processor 
with directions; 

wherein the operational information includes a list of one or more 
resources accessed by the process in the course of a normal and permitted operation; aed 
the databas e file is used by the process in the course of said normal and permitted 
operation to enable the process to access said resources in an optimiz e d manne r: and 
determining the first behavior includes parsing the file to identify the one or more 
resources . 

17. (Currently Amended) A computer program product for providing security, the computer 
program product being embodied in a computer readable medium and comprising computer 
instructions for: 

accessing a databas e file configured by a process to store operational 
information associated with [[a]] tiie process; 

determining a first behavior using the operational information, wherein the 
first behavior is associated with the process; 

monitoring the process; 



Application Serial No. 1 0/802,672 
Attorney Docket No. SYMAP044 



4 



comparing a second behavior with the first behavior, wherein the second 
behavior is attempted by the process; and 

performing a predetermined responsive action if the second behavior is 
different from the first behavior; 

wherein the operational information includes a list of one or more 
resources accessed by the process in the course of a normal and permitted operation; 
the databas e file is used by the process in the course of said normal and permitted 
operation to enable the process to access said resources in an optimiz e d manne r; and 
determining the first behavior includes parsing the file to identify the one or more 
resources. 



18. 



(Canceled) 



19, 



(Canceled) 



20. (Canceled) 
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